CVE-2019-13025 PoC — Compal CH7465LG 输入验证错误漏洞

Source

https://github.com/x1tan/CVE-2019-13025

Associated Vulnerability

Title: Compal CH7465LG 输入验证错误漏洞 (CVE-2019-13025)
Description:Compal CH7465LG CH7465LG-NCIP-6.12.18.24-5p8-NOSH devices have Incorrect Access Control because of Improper Input Validation. The attacker can send a maliciously modified POST (HTTP) request containing shell commands, which will be executed on the device, to an backend API endpoint of the cable modem.

Description

Connect Box CH7465LG (CVE-2019-13025)

Readme

# Connect Box CH7465LG (CVE-2019-13025)

# Information

This repository contains two PoCs for the `Connect Box CH7465LG` running on Firmware `CH7465LG-NCIP-6.12.18.24-5p8-NOSH` or older.

For more information have a look at [my blog](https://xitan.me/posts/connect-box-ch7465lg-rce/).

# Usage

## Unauthenticated Remote Code Execution

> $ python3 poc-rce.py <router_ip> <command>

## Unauthenticated Information Disclosure

> $ python3 poc-information-dump.py <router_ip>

# Credits

xitan 2019.

File Snapshot

Remarks

1. It is advised to access via the original source first.

2. Local POC snapshots are reserved for subscribers — if the original source is unavailable, the local mirror is part of the paid plan.

View subscription plans →